Changeset 2576:93f2aabd0607 for plugins/simpleMenu/_public.php

Timestamp:

11/21/13 11:02:04 (12 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.6

Message:

Escape label and description fields in simpleMenu, fixes #1878

File:

• plugins/simpleMenu/_public.php (modified) (1 diff)

plugins/simpleMenu/_public.php

@@ -96 +96 @@
                     if ($m['descr']) {
                          if ($description == 'title') {
-                              $title = ' title="'.__($m['descr']).'"';
+                              $title = ' title="'.html::escapeHTML(__($m['descr'])).'"';
                          } else {
-                              $span = ' <span>'.__($m['descr']).'</span>';
+                              $span = ' <span>'.html::escapeHTML(__($m['descr'])).'</span>';
                          }
                     }
+                    $label = html::escapeHTML(__($m['label']));
 
                     $item = new ArrayObject(array(
                          'url' => $href,                         // URL
-                         'label' => __($m['label']),        // <a> link label
+                         'label' => $label,                 // <a> link label
                          'title' => $title,                 // <a> link title (optional)
                          'span' => $span,                   // description (will be displayed after <a> link)